OpenSSH 10.5 Ships Five Weeks After 10.4, Citing AI-Discovered Vulnerabilities as Reason for Faster Release Cadence
OpenSSH 10.5 is out, and it is arriving less than a month and a half after the last release. The OpenSSH team is explicitly attributing that compressed schedule to a flood of security reports coming directly from AI models, marking the first time the project has publicly pointed fingers at automated tools for driving its vulnerability intake.
Damien Miller put it plainly in the announcement. "Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance." That acknowledgment matters more than the individual patches. OpenSSH has historically moved at a deliberate pace, batching fixes into quarterly or biannual releases. This new policy of rolling out bug-fix releases on an as-needed basis breaks that tradition. The team notes that AI-discovered bugs are routinely cross-verified by independent researchers, meaning these are not theoretical hallucinations. They are real, exploitable, and landing in production code.
The accelerated cadence is a direct response to the intake volume. 10.4 dropped on July 6, and 10.5 follows just five weeks later on August 11. The 10.3 release sat comfortably out of public view for months before its predecessor, but the project's internal tracking suggests the timeline has always been somewhat fluid. The gap here is meaningful, though.
The Security Fixes
Three vulnerabilities make it into this build. The headline issue is an ssh-agent locking bypass introduced by the session-bind@openssh.com extension. Agent locking is supposed to be a hard barrier against unauthorized use when the agent is locked, but the extension created a logic path that let remote operations slip through. An attacker with access to a forwarded agent socket could add PKCS#11 tokens and pull keys with destination restrictions. The fix comes from sn0x-sharma.
Next, there is a realloc use-after-free bug in the ssh client tied to remote forwarding. If a local multiplexing socket added a forwarding entry while a remote open request was pending, the code tripped over a pointer it no longer owned. Brian Mingus of Cognatory found and patched this one. Exploitation requires a specific race condition, but C memory bugs rarely stay theoretical for long.
The third issue sits in sshd. The restrict keyword in authorized_keys was completely ignoring PermitTunnel, meaning administrators who explicitly disabled tunnel forwarding for certain keys were still leaving the door open. Erichen from the Institute of Computing Technology at the Chinese Academy of Sciences reported it.
New Features and Other Changes
Beyond the patches, 10.5 brings some usability tweaks. ssh-keygen can now set or clear touch-required and verify-required flags on FIDO keys during a passphrase reset, which should smooth out hardware token friction. The ssh client also tries low-friction authenticators first, moving touch-based FIDO keys ahead of PINs and biometrics. If you manage a server with dozens of candidate keys, the new ssh -Z user@host flag will print them in the order they will be attempted, which is a decent shortcut for debugging slow authentications. There is also a setproctitle(3) change for the sshd-session monitor that makes process titles more readable in system logs.
Two contributions from Christopher Paul Rohlf at Anthropic land in this release as well. One shrinks the pre-auth attack surface by checking public key types against allowed algorithms before parsing the peer's key. The other fixes a double-free in ssh-keygen and switches sensitive memory deallocation to freezero. These are not the kind of changes that typically come from automated scanners, but they sit alongside the AI-discovered reports in the same build.
Portable OpenSSH now requires Elliptic Curve Cryptography support in libcrypto, specifically the NIST P-521 curve. If you are running a custom build with --without-openssl, you will need to adjust. Everything else, including default builds across LibreSSL, OpenSSL, BoringSSL, and AWS LC, already ships with ECC support.
The move pushes the project fully into the ECC era. P-521 offers roughly 128-bit security with 512-bit keys, which is meaningfully lighter than the 3072-bit RSA equivalents it is replacing.
The accelerated release schedule reflects more than just AI tooling. OpenSSH 10.4 was already security-heavy, addressing Swival scanner findings, a DisabledForwarding bypass, Terrapin-style message ordering flaws, and experimental ML-DSA 44 composite signatures. Both builds suggest an active threat landscape. However, at the same time, whether AI is the primary driver or just a mirror reflecting existing static analysis tools is still unclear. The team's decision to acknowledge it anyway sets a precedent other maintainers might follow.
If you run OpenSSH in production, patch promptly. Five weeks between releases with acknowledged AI-discovered vulnerabilities usually means the bugs are already in the wild. Verify that agent locking rejects session-bind requests as expected after the upgrade, and audit any authorized_keys files that pair restrict with PermitTunnel. Keep in mind that the restriction now applies correctly to tunnel forwarding, so old configs relying on the broken behavior need a review.
Head here to download the release.
